Tab K9 Tb305Xu
Monthly
Multiple Lenovo consumer tablets - including the Idea Tab Pro (TB373FU), Idea Tab / Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU), Tab M11 (TB330FU/TB330XU), Legion Tab 8.8" Gen 3 (TB321FU), Tab Extreme (TB570FU/TB570ZU), and a broader set of Tab and Yoga Tab models - contain a physical-access authentication bypass (CWE-288) that lets someone in direct possession of the device defeat the lock/authentication flow and gain unauthorized access to the device and its data. Rated 7.0 under CVSS 4.0 (AV:P/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact), the issue requires no credentials (PR:N) and no user interaction (UI:N), so the decisive limiting factor is the Physical attack vector: there is no remote or adjacent-network exposure and only lost, stolen or unattended units are at risk. No public exploit code has been identified at time of analysis, and the specific alternate authentication path involved has not been disclosed by the vendor.
Arbitrary code execution is possible on a broad set of Lenovo consumer tablets - including the Idea Tab Pro TB373FU, Idea Tab / Lenovo Tab K11 Gen 2 TB336FU and TB336ZU, Legion Tab TB321FU, Tab M11 TB330FU and TB330XU, Tab Extreme TB570FU and TB570ZU, and Tab K11 TB330FUP, with additional models enumerated in vendor tagging (Tab K11 Plus, Tab K9, Tab One, Tab P12, Tab Plus, Yoga Tab, Yoga Tab Plus, and the TB311FU/TB311XU folio and clear-case variants) - by an attacker who has physical possession of the tablet while it is already unlocked. The CVSS 4.0 base score is 5.4 (MEDIUM), with vector AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, meaning exploitation requires the attacker to be physically at the device (AV:P), no prior privileges are needed (PR:N), no victim interaction is required beyond the device already being unlocked (UI:N), and attack requirements are present (AT:P) in the form of physical custody plus an unlocked state; the flaw affects a device's own confidentiality, integrity and availability but does not propagate to subsequent systems. No CISA KEV listing is associated with this CVE and no public exploit code has been identified at time of analysis, so real-world risk is bounded by the physical and unlocked-device preconditions - a locked, powered-off, or patched unit is not exploitable via this issue.
Multiple Lenovo consumer tablets - including the Idea Tab Pro (TB373FU), Idea Tab / Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU), Tab M11 (TB330FU/TB330XU), Legion Tab 8.8" Gen 3 (TB321FU), Tab Extreme (TB570FU/TB570ZU), and a broader set of Tab and Yoga Tab models - contain a physical-access authentication bypass (CWE-288) that lets someone in direct possession of the device defeat the lock/authentication flow and gain unauthorized access to the device and its data. Rated 7.0 under CVSS 4.0 (AV:P/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact), the issue requires no credentials (PR:N) and no user interaction (UI:N), so the decisive limiting factor is the Physical attack vector: there is no remote or adjacent-network exposure and only lost, stolen or unattended units are at risk. No public exploit code has been identified at time of analysis, and the specific alternate authentication path involved has not been disclosed by the vendor.
Arbitrary code execution is possible on a broad set of Lenovo consumer tablets - including the Idea Tab Pro TB373FU, Idea Tab / Lenovo Tab K11 Gen 2 TB336FU and TB336ZU, Legion Tab TB321FU, Tab M11 TB330FU and TB330XU, Tab Extreme TB570FU and TB570ZU, and Tab K11 TB330FUP, with additional models enumerated in vendor tagging (Tab K11 Plus, Tab K9, Tab One, Tab P12, Tab Plus, Yoga Tab, Yoga Tab Plus, and the TB311FU/TB311XU folio and clear-case variants) - by an attacker who has physical possession of the tablet while it is already unlocked. The CVSS 4.0 base score is 5.4 (MEDIUM), with vector AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, meaning exploitation requires the attacker to be physically at the device (AV:P), no prior privileges are needed (PR:N), no victim interaction is required beyond the device already being unlocked (UI:N), and attack requirements are present (AT:P) in the form of physical custody plus an unlocked state; the flaw affects a device's own confidentiality, integrity and availability but does not propagate to subsequent systems. No CISA KEV listing is associated with this CVE and no public exploit code has been identified at time of analysis, so real-world risk is bounded by the physical and unlocked-device preconditions - a locked, powered-off, or patched unit is not exploitable via this issue.